Authentication bypass in Keeper K5 HD Network Camera

Published: 2019-09-20 | Updated: 2019-09-20
Severity Low
Patch available NO
Number of vulnerabilities 1
CVE ID CVE-2019-16398
CWE ID CWE-20
Exploitation vector Local
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software Keeper K5 Subscribe
Vendor Keeper

Security Advisory

This security advisory describes one low risk vulnerability.

1) Input validation error

Severity: Low

CVSSv3: 6.4 [CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C] [PCI]

CVE-ID: CVE-2019-16398

CWE-ID: CWE-20 - Improper Input Validation

Description

The vulnerability allows a local attacker to execute arbitrary code on the target device.

The vulnerability exists due to insufficient validation of user-supplied input. An attacker with physical access to the device can insert an SD card containing a file named "zskj_script_run.sh" that executes arbitrary code.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Keeper K5: -, 20.1.0.25, 20.1.0.63

CPE External links


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.